From b0d2411c9c48b49fff827841c5ec6b66533d9c58 Mon Sep 17 00:00:00 2001 From: Igor Fedotov Date: Fri, 19 Apr 2019 15:43:07 +0300 Subject: [PATCH] os/bluestore: fix out-of-bound access in bmap allocator. Fixes: https://tracker.ceph.com/issues/39334 Signed-off-by: Igor Fedotov --- src/os/bluestore/fastbmap_allocator_impl.cc | 16 +++++++++------- src/os/bluestore/fastbmap_allocator_impl.h | 12 +++++------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/src/os/bluestore/fastbmap_allocator_impl.cc b/src/os/bluestore/fastbmap_allocator_impl.cc index f6369071baaa3..1dd491d11f927 100755 --- a/src/os/bluestore/fastbmap_allocator_impl.cc +++ b/src/os/bluestore/fastbmap_allocator_impl.cc @@ -286,20 +286,22 @@ void AllocatorLevel01Loose::_mark_alloc_l0(int64_t l0_pos_start, int64_t pos = l0_pos_start; slot_t bits = (slot_t)1 << (l0_pos_start % d0); - - while (pos < std::min(l0_pos_end, p2roundup(l0_pos_start, d0))) { - l0[pos / d0] &= ~bits; + slot_t* val_s = &l0[pos / d0]; + int64_t pos_e = std::min(l0_pos_end, p2roundup(l0_pos_start + 1, d0)); + while (pos < pos_e) { + (*val_s) &= ~bits; bits <<= 1; pos++; } - - while (pos < std::min(l0_pos_end, p2align(l0_pos_end, d0))) { - l0[pos / d0] = all_slot_clear; + pos_e = std::min(l0_pos_end, p2align(l0_pos_end, d0)); + while (pos < pos_e) { + *(++val_s) = all_slot_clear; pos += d0; } bits = 1; + ++val_s; while (pos < l0_pos_end) { - l0[pos / d0] &= ~bits; + (*val_s) &= ~bits; bits <<= 1; pos++; } diff --git a/src/os/bluestore/fastbmap_allocator_impl.h b/src/os/bluestore/fastbmap_allocator_impl.h index a7c7305de5ab3..4143f3d5d53f6 100755 --- a/src/os/bluestore/fastbmap_allocator_impl.h +++ b/src/os/bluestore/fastbmap_allocator_impl.h @@ -337,25 +337,23 @@ protected: auto pos = l0_pos_start; slot_t bits = (slot_t)1 << (l0_pos_start % d0); - slot_t& val_s = l0[pos / d0]; + slot_t* val_s = &l0[pos / d0]; int64_t pos_e = std::min(l0_pos_end, p2roundup(l0_pos_start + 1, d0)); while (pos < pos_e) { - val_s |= bits; + *val_s |= bits; bits <<= 1; pos++; } pos_e = std::min(l0_pos_end, p2align(l0_pos_end, d0)); - auto idx = pos / d0; while (pos < pos_e) { - l0[idx++] = all_slot_set; + *(++val_s) = all_slot_set; pos += d0; } bits = 1; - ceph_assert((pos / d0) < l0.size()); - uint64_t& val_e = l0[pos / d0]; + ++val_s; while (pos < l0_pos_end) { - val_e |= bits; + *val_s |= bits; bits <<= 1; pos++; } -- 2.39.5